Wednesday, May 14, 2025
HomeComputer SecurityTurla Group Updated ComRAT Malware to Use Gmail web Interface for Command...

Turla Group Updated ComRAT Malware to Use Gmail web Interface for Command and Control

Published on

SIEM as a Service

Follow Us on Google News

The ComRAT malware is a remote administration tool and is used by the Turla hacker group. It was first spotted in November 2014. The Trula hacker group is active for more than ten years.

ComRAT malware also known as Agent.BTZ, the first version of it was released in 2007. It becomes infamous after it was used to breach the US military in 2008.

Turla’s operators known for maintaining a large arsenal of malware includes a rootkit, several complex backdoors aimed at different platforms, including Microsoft Exchange mail servers, and a large range of tools to enable pivoting on a network.

- Advertisement - Google News

ComRAT Malware

A new variant of ComRAT malware found by researchers in 2017 and it is active as recently as January 2020. Three targets were identified; two of them are ministries of Foreign Affairs and a national parliament.

The main use of the ComRAT malware is to steal confidential documents, in one such case researchers observed that “deployed a .NET executable to interact with the victim’s central MS SQL Server database containing the organization’s documents.”

In addition to document stealing the hacker group runs various commands to gather information about services such as “Active Directory groups or users, the network, or Microsoft Windows configurations such as the group policies.”

ComRAT Malware
ComRAT Malware Operation

The most recently compiled ComRAT malware dated November 2019, according to the ESET telemetry, the malware was installed using an existing foothold such as compromised credentials or via another Turla backdoor.

All the files associated with ComRAT are stored in a Virtual File System and the VFS is encrypted using AES-256 in XTS mode.

Two Command and Control channels

  • HTTP – The malware makes HTTP requests to its C&C server.
  • Email – Uses the Gmail web interface to receive commands and exfiltrate data
Gmail used for C&C

The most interesting feature with the new version of the malware uses the Gmail web UI to receive commands and exfiltrate data.

So that attackers can bypass some security solutions as the communication not from the malicious domains. Eset published a detailed report with Indicators of compromise.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Windows Ancillary for WinSock 0-Day Vulnerability Actively Exploited to Gain Admin Access

Microsoft has confirmed active exploitation of a critical privilege escalation vulnerability in the Windows...

Earth Ammit Hackers Deploy New Tools to Target Military Drones

The threat actor group known as Earth Ammit, believed to be associated with Chinese-speaking...

New Microsoft Scripting Engine Vulnerability Exposes Systems to Remote Code Attacks

Critical zero-day vulnerability in Microsoft’s Scripting Engine (CVE-2025-30397) has been confirmed to enable remote...

Critical Microsoft Office Vulnerabilities Enable Malicious Code Execution

Microsoft has addressed three critical security flaws in its Office suite, including two vulnerabilities...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Windows Ancillary for WinSock 0-Day Vulnerability Actively Exploited to Gain Admin Access

Microsoft has confirmed active exploitation of a critical privilege escalation vulnerability in the Windows...

Earth Ammit Hackers Deploy New Tools to Target Military Drones

The threat actor group known as Earth Ammit, believed to be associated with Chinese-speaking...

New Microsoft Scripting Engine Vulnerability Exposes Systems to Remote Code Attacks

Critical zero-day vulnerability in Microsoft’s Scripting Engine (CVE-2025-30397) has been confirmed to enable remote...